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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 (Public Law 1 07-296) by amendment to the Inspector General Act 
of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 
oversight responsibilities to promote economy, efficiency, and effectiveness within the department. 

The attached report presents the results of the audit of the United States Coast Guard's fiscal year 
2008 Mission Action Plans. We contracted with the independent public accounting firm KPMG LLP 
(KPMG) to perform the audit. The contract required that KPMG perform the audit according to 
generally accepted government auditing standards and guidance from the Office of Management and 
Budget and the Government Accountability Office. KPMG is responsible for the attached auditor's 
report and the conclusions expressed in the report. 

The recommendations herein have been discussed in draft with those responsible for implementation. 
We trust this report will result in more effective, efficient, and economical operations. We express 
our appreciation to all of those who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 



KPMG LLP 

2001 M Street, NW 
Washington, DC 20036 



May 12, 2009 

Ms. Anne Richards 

Assistant Inspector General for Audit 

Department of Homeland Security, Office of the Inspector General 

Ms. Peggy Sherry 

Acting Chief Financial Officer 

Department of Homeland Security 

This report presents the results of our work conducted to address the performance audit objectives relative 
to the Department of Homeland Security's (DHS or the Department) Mission Action Plans (MAPs) 
developed to address the internal control deficiencies at the U.S. Coast Guard (USCG). These deficiencies 
were identified by management and/or reported in the KPMG LLP (KPMG) Independent Auditors' 
Report included in the Department's fiscal year 2008 Annual Financial Report. 

This performance audit is part of a series of three performance audits that the Department's Office of 
Inspector General (OIG) engaged us to perform related to the Department's fiscal year 2009 MAPs for 
use in developing the Department's Internal Control Over Financial Reporting (ICOFR) Playbook. This 
performance audit was designed to meet the objectives identified in the Objectives, Scope, Methodology 
and Approach section of this report. Our procedures were performed using the MAPs provided to us on 
November 28, 2008. Interviews with DHS and USCG management and other testwork was performed at 
various times through May 12, 2009, and our results reported herein are as of May 12, 2009. 

We conducted this performance audit in accordance with Government Auditing Standards. Those 
standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide 
a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the 
evidence obtained provides a reasonable basis for our findings based on our audit objectives. 

This performance audit did not constitute an audit of the financial statements in accordance with 
Government Auditing Standards. KPMG was not engaged to, and did not, render an opinion on the 
Department's or USCG's internal control over financial reporting or over financial management systems 
(for purposes of OMB Circular No. A- 127, Financial Management Systems, as revised). KPMG cautions 
that projecting the results of our evaluation to future periods is subject to the risks that controls may 
become inadequate because of changes in conditions or because compliance with controls may 
deteriorate. 
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EXECUTIVE SUMMARY 

The Department has identified deficiencies in internal control over financial reporting through its annual 
assessment conducted pursuant to Office of Management and Budget (OMB) Circular No. A- 123, 
Management 's Responsibility for Internal Control, and in compliance with the Federal Managers ' 
Financial Integrity Act (FMFIA). Some of the deficiencies were identified as significant deficiencies or 
material weaknesses, in the Independent Auditors' Report included in the FY 2008 DHS Annual 
Financial Report (AFR). Beginning in 2006, the Department began a comprehensive corrective action 
plan to remediate known internal control deficiencies. The plan is documented in the Internal Controls 
Over Financial Reporting Playbook (ICOFR Playbook). The Mission Action Plan (MAP) is a key 
element of the ICOFR Playbook that documents the remediation actions planned for each internal control 
deficiency at the DHS component level. The MAP provides specific actions, timeframes, key milestones, 
assignment of responsibility, and validation procedures. 

The U.S Coast Guard (USCG) developed multi-year MAPs related to significant deficiencies or material 
weaknesses (as presented in the FY 2008 Independent Auditor's Report) submitted by USCG to the 
Department's Chief Financial Officer for inclusion in the FY 2009 ICOFR Playbook. The MAPs focus on 
two parallel tracks during FY 2009 and FY 2010. Track One consists of three focus areas USCG 
management, in conjunction with DHS Office of the Chief Financial Officer (OCFO), has determined to 
have larger impact on the DHS balance sheet and they are not limited by the USCG Core Accounting 
Systems (CAS). Track Two consists of focus areas USCG management has determined to be necessary 
for the successful remediation of the Balance Sheet line items, which may be limited by CAS, and/or do 
not have substantial impact on the Balance Sheet as the Track One focus areas. Track Two focus areas are 
not within the scope of this audit. Track One MAPs address control deficiencies identified in the 
following areas: 

• Fund Balance with Treasury (FBwT) 

• Property, Plant and Equipment (Construction in Process and Personal Property) 

• Actuarial Pension Liabilities 

Objective, Scope, Methodology and Approach 

We conducted our audit in accordance with the standards applicable to such audits contained in the 
Government Auditing Standards. 

The objective of this performance audit was to evaluate and report on the status of the Track One MAPs 
described above. We did not evaluate the outcome of the MAP process or any corrective actions taken by 
management during our audit, and our findings should not be used to project ultimate results from MAP 
implementation. Our audit was performed using criteria to evaluate the MAP development process and 
content. The evaluation criteria were developed from a variety of sources including technical guidance 
published by OMB, the Government Accountability Office, and from applicable laws and regulations. 
We also considered DHS' policies and guidance, and input from the Office of Inspector General (OIG) 
when designing evaluation criteria. Our evaluation criteria were: 

• Identification (of the root cause) - Identification of the appropriate underlying root cause that is 
causing the internal control deficiency condition(s). 

• Development (of the MAP) - Clear action steps that address the root cause, and attainable and 
measurable milestones at an appropriate level of detail. 

• Accountability (for execution of the MAP) - The individual MAP owner is responsible for its 
successful implementation, ensuring that milestones are achieved and that the validation phase is 
completed. 

• Verification and validation - The MAP includes written procedures to verify successful 
implementation of the MAP, a means to track progress throughout the MAP lifecycle, and 
reporting results when complete. 
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Findings and Recommendations: 

We found that USCG has prepared MAPs that address its known control deficiencies for track one focus 
areas described above, and the MAPs were submitted timely to the Department for inclusion with the FY 
2009 ICOFR Playbook. Specifically, we noted that: 

1. The Fund Balance with Treasury (FBwT) and the Property, Plant and Equipment (PP&E - 
Construction in Process and Personal Property) MAPs substantially meet the evaluation criteria 
described above. 

2. The Actuarial Pension Liability MAP did not meet all the evaluation criteria above. We noted minor 
findings related to the Identification and Development criteria. We reported that USCG did not 
include one of the conditions identified in the audit finding in the MAP, and did not perform 
comprehensive root cause analysis for all the conditions identified in the audit. 

We recommended that USCG expand the Actuarial Pension Liability MAP to include all the control 
deficiencies identified by management or the Independent Auditors. The MAP should include root 
cause analysis, specific and measurable action steps, assignments to individuals and means to validate 
the results of the key milestones. 

USCG also developed MAPs for the Track Two focus area and may have modified the Track One MAPs 
subsequent to November 28, 2008 (the date that the MAPs were provided to KPMG). However, we have 
not performed audit procedures on Track Two MAPs or any modification made to the MAPs after 
November 28, 2008. The Track Two MAPs and the effects of any modification made subsequent to 
November 28, 2008 are not reflected in this report. 
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BACKGROUND 



The Department of Homeland Security (DHS) and the U.S Coast Guard (USCG) recognize that 
deficiencies in internal control exist. The internal control deficiencies are reported by DHS management 
in its annual Secretary's Assurance Statement, issued pursuant to OMB Circular A- 123, Management's 
Responsibility for Internal Control. The Secretary's Assurance Statement and the findings of the external 
auditor were reported in the Department's fiscal year (FY) 2008 Annual Financial Report (AFR). The 
conditions causing the internal control weaknesses are diverse and complex. Many conditions, which are 
systemic, were inherited with the legacy financial processes and IT systems in place at the time of the 
Department's formation in 2003. The evolution of the Department's mission, programs, component 
restructuring, and other infrastructure changes, has made remediation of these internal control weaknesses 
challenging. To meet this challenge, the Department's Secretary, Chief Financial Officer and financial 
management in the DHS components adopted a comprehensive strategy to implement corrective actions 
beginning in FY 2006 and continuing in future years. 

The Office of the Chief Financial Officer (OCFO), Internal Control Program Management Office 
(ICPMO) is primarily responsible for the development and implementation of the Department's strategy 
to implement Mission Action Plans (MAPs). The ICPMO has documented their strategy and other 
related plans to remediate identified internal control deficiencies in the Internal Controls Over Financial 
Reporting Playbook (ICOFR Playbook). 

In 2006, the Department issued Management Directive 1030, Corrective Action Plans, and the 
Department enhanced its existing guidance by issuing the FY 2009 Mission Action Plan Guide (MAP 
Guide). To comply with Management Directive 1030, and the MAP Guide, the USCG adopted the 
Financial Strategy for Transformation and Audit Readiness (FSTAR) initiative. USCG/FSTAR grouped 
the MAP into two distinct focus areas based on priority. Management has determined that Track One 
focus areas (FBwT, PP&E and Actuarial Liabilities — Pension) have a large impact on the DHS balance 
sheet and are not limited by the USCG Core Accounting Systems (CAS). Track Two consists of 
additional corrective actions that are necessary for the successful remediation of the balance sheet line 
items, which may be limited by CAS, and/or do not have substantial impact on the Balance Sheet as the 
Track One focus areas. For FY 2009, USCG is concentrating its remediation efforts on Track One 
deficiencies which are summarized below: 

• Fund Balance with Treasury - USCG did not have effective controls or supporting documentation 
that validated the existence, completeness and accuracy of all of its FBwT balances, 
reconciliations, and clearing of suspense items. It did not have an effective process for accounting 
for suspense account transactions related to FBwT. The USCG was unable to provide validated 
military and civilian payroll data to support payroll transactions processed through the USCG's 
FBwT. 

• Property, Plant and Equipment - USCG did not consistently apply policies and procedures to 
ensure appropriate documentation supporting PP&E acquisitions, and their existence, is 
maintained to support capitalized PP&E. In addition, USCG did not implement accurate and 
complete asset identification, and did not properly account for some improvements and 
impairments to building and structures, capital leases and selected useful lives for depreciation 
purposes. Further, USCG did not implement appropriate controls and related processes to 
accurately, consistently, and timely record additions to PP&E and construction in process (CIP), 
transfers from other agencies, disposals in its fixed asset system, and valuation and classification 
of repairable PP&E. 

• Actuarial Pension Liabilities - USCG did not have effective policies, procedures, and controls to 
ensure the completeness and accuracy of participant data, medical cost data, and trend and 
experience data provided to, and used by, the actuary for the calculation of the Military 
Retirement System (MRS) pension, medical, and post employment benefit liabilities. In addition, 
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USCG did not have effective policies, procedures and internal controls over the Coast Guard's 
process for reconciling military payroll recorded in CAS general ledger to detail payroll record. 
Military personnel data changes, including changes in leave balances and payroll corrections, are 
not processed in the appropriate payroll and/or reporting periods, and consequently impact the 
completeness and accuracy of leave and payroll accruals as well as data used for actuarial 
projections. 

OBJECTIVE, SCOPE, METHODOLOGY AND APPROACH 
Objective and Scope 

The objective of this performance audit was to evaluate and report on the status of detailed MAPs 
prepared by USCG to correct internal control deficiencies that are contributing to the Department's 
significant deficiencies or material weaknesses existing at the end of FY 2008. Our evaluation was 
performed using evaluation criteria, described in the methodology section below, to assess the process 
used to develop and document USCG's FY 2009 MAPs. Our findings are presented below. We did not 
evaluate the outcome of the MAP process or any corrective actions taken by management during our 
audit, and our findings should not be used to project ultimate results from MAP implementation. 
Recommendations are provided to help address findings identified during our performance audit. 

The MAPs subjected to our evaluation were: 

1 . Fund Balance with Treasury (FBWT); 

2. Property, Plant and Equipment (PP&E); 

3. Actuarial Pension Liabilities 

The MAPs were provided to us by USCG on November 28, 2008. The scope of this performance audit 
did not include procedures on any of the MAPs associated with other control deficiencies existing at 
USCG as of September 30, 2008. Our audit was performed between January 12, 2009 and May 12, 2009, 
and our results reported herein are as of May 12, 2009. 

USCG continued to make modifications to the MAPs noted above after November 28, 2008 (the date we 
received the MAPs), some of which may have addressed the comments below. However, we have not 
performed audit procedures on any modifications made to MAP's after the start of our audit, and the 
effect of those modifications are not reflected in this report. 

Methodology and Approach 

We conducted this performance audit in accordance with the standards applicable to such audits contained 
in the Government Auditing Standards. Our methodology consisted of the following four-phased 
approach: 

Project Initiation and Planning - We attended meetings with the Department's OIG, OCFO, and USCG 
to review the performance audit objectives, scope, describe our approach, communicate data requests, and 
to gain an understanding of the status of USCG's 2009 MAPs. 

Data Gathering - We performed interviews with accounting and finance management and staff at USCG 
and OCFO. Through these interviews, we gained an understanding of the process used to develop the 
MAPs, including key inputs and data used, assumptions made, and reasons for conclusions reached. The 
interviews focused on the analysis performed by USCG to identify the underlying problems creating the 
internal control weakness (root cause) and planned corrective actions, the critical milestones chosen for 
measurement, and the methods used to monitor and validate progress in meeting the milestones. We 
discussed USCG's resource allocation strategy employed in the development and eventual 
implementation of the MAP, including the utilization of contractors to supplement staff as needed and the 
use of specialists, if necessary. We conducted meetings with the Department's OIG to identify and agree 
to the criteria used to evaluate the status of the MAPs (as defined below). 
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We performed reviews of key documents and supporting information provided to us by OCFO. Our 
documentation reviews included: 

• The USCG Track One MAPs (i.e., the MAP Detail and Summary Reports) that were included 
within our scope, and any underlying supporting documentation provided by USCG. 

• The Notices of Findings and Recommendations (NFRs) issued during the FY 2008 financial 
statement audit by the external auditors that supported the internal control findings reported in the 
FY 2008 Independent Auditors' Report. 

• The Secretary's Assurance Statements provided pursuant to the requirements of OMB Circular 
A-123. 

• The Annual Component Head Assurance Statements provided pursuant to the requirements of 
OMB Circular A-123. 

• The ICOFR Playbook, MD 1030, the MAP Guide, and existing internal control monitoring 
guidance (e.g., OMB Circular No. A-123). 

Analysis Using Established Criteria - Our evaluation criteria was developed from a variety of sources 
including technical guidance published by OMB, e.g., Circular A-123, the GAO, e.g. Standards for 
Internal Control in the Federal Government, and applicable Federal laws and regulations, e.g., Federal 
Managers ' Financial Integrity Act (FMFIA). We also considered DHS' policies and guidance, e.g. the 
MAP Guide and the ICOFR Playbook, and input from the OIG. Our evaluation criteria were: 

• Identification (of the root cause) - Identification of the appropriate underlying root cause that is 
causing the internal control deficiency. A comprehensive analysis typically includes a full 
assessment of the business processes, data flows, and information systems that drive the 
transactions/activities associated with the accounting process where the internal control 
deficiencies are believed to exist. A thorough root cause analysis should include: 

- Research to discover why, when, how the condition occurred - what went wrong and why? 

- Investigation to determine if the problem is design, or execution, or both. 

- An evaluation to determine if IT system functionality is contributing to the problem and if IT 
system modifications could be part of the remediation. 

- An evaluation of internal controls, including the existence of compensating controls that may 
mitigate the deficiency. 

• Development (of the MAP) - The MAP includes action steps that address the root cause, and 
attainable and measurable milestones at an appropriate level of granularity. Milestones should 
enable independent analysis of a MAP's effectiveness in remediation of root causes and provide 
MAP users with insight on the status of the MAP's implementation. For example, the MAP 
should enable a user to determine if the appropriate level of resources to execute a milestone is 
available and to identify potential gaps in milestones (e.g. a contractor may be needed before a 
specific milestone can be achieved). 

• Accountability (for execution of the MAP) - Accountability for the MAP is clearly identified and 
assigned. The individual MAP owner is responsible for its successful implementation, ensuring 
the achievement of milestones and validation of results. 

• Verification and Validation - The MAP includes written procedures that verify successful 
implementation of the MAP, a means to track progress throughout the MAP lifecycle, and 
reporting results when complete. These activities should include documentation reviews, work 
observations, and performance testing that is maintained for internal OMB A-123 review and 
external audit. 

Findings and Recommendations - After conducting our audit, we formulated our findings and 
recommendations. The findings represent areas for potential improvement that could negatively affect 
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USCG's remediation of the significant deficiencies and/or material weaknesses if the MAP is performed 
as designed. 



FINDINGS AND RECOMMENDATIONS 
Conditions 

USCG prepared and submitted MAPs to the ICPMO as instructed in the MAP Guide. The MAPs address 
each of the Track One focus area processes where significant deficiencies and material weaknesses 
existed at the end of FY 2008. Based on our inquiry with USCG personnel, we determined that USCG 
was knowledgeable of the MAP Guide, performed a review to determine the source and cause of the 
control deficiencies, and incorporated the results into the individual MAPs in the form of milestones. 
USCG management linked the MAPs milestones to key financial statement assertions affected by the 
control weaknesses. 

The chart below identifies our findings by MAP and criteria. Substantial variation from the evaluation 
criteria, and therefore areas where the MAP could be improved with further analysis and development, is 
identified by a shaded box. No or only minor variation from the evaluation criteria is identified with an 
empty box. 



Matrix of Conditions 


Criteria: MAP: 


FBwT 


PP&E 


AL 


Identification (of root cause) 








Development of MAP 








Accountability of the MAP 








Validation & Verification 









Key: 

FBwT - Fund Balance with Treasury 
PP&E- Property, Plant & Equipment 
AL — Actuarial Pension Liability 



Fund Balance with Treasury and Property, Plant & Equipment - The FBwT and PP&E (including 
Construction in Process and Personal Property) MAPs are generally well developed and meet the criteria 
(defined previously). USCG performed detailed root cause analysis and identified critical 
interdependencies and developed comprehensive plans to remediate the conditions identified. The MAPs 
milestones are linked directly to the financial statement assertions affected by the control weaknesses. 
Accountability for remediation is clearly assigned and validation and verification steps are also included. 

Actuarial Pension Liability - The Actuarial Pension Liability MAP did not include one of the conditions 
identified and reported by the external auditors in the FY2008 Independent Auditors' Report and USCG 
did not perform comprehensive root cause analysis for all the conditions identified in the audit. The 
condition related to developing materiality threshold for USCG personal data and its actuarial pension 
liability was not included in the MAP. USCG did not link all of the conditions identified in the issue 
description section of the MAP to the audit findings which led to one of the conditions being left out in 
the MAP development. The MAPs for the conditions included are generally well developed. They contain 
root cause analysis, identification of interdependencies, proper assignment of accountability, and 
validation and verification steps. 

Cause/Effect 

The conditions noted above are due to the preliminary stage of development of the MAPs. Management 
has relatively little time from year-end (i.e., September 30, 2008) to the date of submission of the MAPs 
to the DHS Office of the Chief Financial Officer for review. Further development of the MAPs after the 
date of submission is common. A lack of a comprehensive and detailed MAP could lead to the control 
deficiencies not being corrected. 
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Recommendations 

We recommend that USCG perform the following to address our findings. 

1 . Actuarial Pension Liability: 

a. Review the MAP to determine that all conditions for each control deficiency identified by the 
external auditors in the FY2008 Independent Auditors' Report have been included in the MAP. 
Cross-reference the conditions on the MAPs to the conditions identified on the NFRs. 
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MANAGEMENT RESPONSE TO REPORT 



Management has prepared an official response below agreeing with our findings and its comments were 
responsive to our recommendations. We did not audit management's response and, accordingly, we 
express no opinion on it. 

". . .The Coast Guard concurs with the findings and recommendations contained in the report. The Coast 
Guard has completed the actions recommended in the report: all conditions for each control deficiency 
identified by the external auditors in the FY 2008 Independent Auditors Report have been included in the 
MAP and the MAPs have been cross referenced to the conditions identified on the NFRs. In addition, for 
the one condition that was omitted from the original Actuarial Pension Liabilities MAP, 75% of the tasks 
added to the MAP to resolve the conditions have been completed, with the remaining tasks expected to be 
completed within 90 days. . ." 
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KEY DOCUMENTS AND DEFINITIONS 



This section provides key definitions and documents for the purposes of this report. 

The Federal Managers ' Financial Integrity Act (FMFIA) requires that Executive Branch Federal agencies 
establish and maintain an effective internal control environment according to the standards prescribed by 
the Comptroller General. Those standards are published in the Government Accountability Office's 
(GAO) Standards for Internal Control in the Federal Government. In addition, it requires the head of the 
agency to annually evaluate and report on the adequacy of the agency's systems of internal accounting 
and administrative control. 

GAO's Standards for Internal Control in the Federal Government (Standards) defines internal control as 
an integral component of an organization's management that provides reasonable assurance of: 
effectiveness and efficiency of operations, reliability of financial reporting, and compliance with 
applicable laws and regulations. 

The Department of Homeland Security Financial Accountability Act (the DHS FAA) brought the Chief 
Financial Officer (CFO) for DHS under the Chief Financial Officers Act, thus making the DHS CFO a 
Presidentially appointed position requiring Senate confirmation. Furthermore, the DHS FAA requires 
that an audit opinion of the internal controls over financial reporting be included in the Department's 
Performance and Accountability Report. 

Office of Management and Budget (OMB) Circular No. A-123, Management's Responsibility for Internal 
Control, provides guidance on internal controls and requires agencies and Federal managers to 1) develop 
and implement internal controls; 2) assess the adequacy of internal controls; 3) separately assess and 
document internal control over financial reporting; 4) identify needed improvements; 5) take 
corresponding corrective action; and 6) report annually on internal controls. The successful 
implementation of these requirements facilitates compliance with both FMFIA and the Chief Financial 
Officers Act. 

Office of Management and Budget (OMB) Circular No. A- 127, Financial Management Systems, 
prescribes policies and standards for executive departments and agencies to follow in developing, 
operating, evaluating, and reporting on financial management systems. The successful implementation 
of these requirements facilitates compliance with both FMFIA and the Chief Financial Officers Act. 

Internal Control Deficiencies - A control deficiency exists when the design or operation of a control 
does not allow management or employees, in the normal course of performing their assigned functions, 
to prevent or detect misstatements on a timely basis. A significant deficiency is a control deficiency, or 
combination of control deficiencies, that adversely affects DHS' ability to initiate, authorize, record, 
process, or report financial data reliably in accordance with U.S. generally accepted accounting 
principles such that there is more than a remote likelihood that a misstatement of DHS' financial 
statements that is more than inconsequential will not be prevented or detected by DHS' internal control 
over financial reporting. A material weakness is a significant deficiency, or combination of significant 
deficiencies, that results in more than a remote likelihood that a material misstatement of the financial 
statements will not be prevented or detected by DHS' internal control. 

Management Directive (MP) 1030, Corrective Action Plans, establishes DHS' vision and direction on the 
roles and responsibilities for developing, maintaining, reporting, and monitoring CAPs (i.e., MAPs) 
specific to the DHS FAA, FMFIA, and related OMB guidance. In addition to roles and responsibilities, 
MD 1030 outlines the policies and procedures related to the CAP process. The organizational structure 
detailed in MD 1030 encompasses employees at all components and offices. 

The Internal Controls Over Financial Reporting (ICOFR) Playbook (ICOFR Playbook) was developed 
by the OCFO, Internal Control Program Management Office, to design and implement department-wide 
internal controls, pursuant to the DHS FAA, OMB Circular No. A-123, and FMFIA. Per the Executive 
Summary in the FY 2008 ICOFR Playbook, the Playbook outlines the Department's "strategy to design 
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and implement an effective internal control system to support the mission, eliminate material weaknesses, 
and build management assurances." On an annual basis, the ICOFR Playbook is updated by the OCFO to 
enhance its existing guidance, as necessary, and establish action plan milestones, which will be monitored 
by the OCFO throughout the year. One component of the ICOFR Playbook includes MAPs developed by 
the Department and its components to correct material weakness conditions and document 
accomplishments and progress (according to the FY 2008 Playbook). 

The Mission Action Plan Guide, Financial Management Focus Areas Fiscal Year 2008 (MAP Guide) 
outlines the policies and procedures to be used to develop MAPs throughout DHS, pursuant to the roles 
and responsibilities established by the DHS Management Directive (MD) 1030, Corrective Action Plans. 
The MAP Guide applies to all Department Components and Offices (e.g., OCFO) where a control 
deficiency has been identified. Note non-conformances related to the Federal Information Security 
Management Act (FISMA), are under the purview of the Department's Chief Information Security 
Officer 's Plan of Action and Milestones (POA&M) Process Guide. 

Electronic Program Management Office (ePMO) is a Web-based software application the OCFO 
deployed to manage the collection and reporting of MAP information. 

Mission Action Plans (MAPs), as defined in the MAP Guide, are documents prepared to facilitate the 
remediation of internal control deficiencies identified by management or by external parties. MAP 
documentation, as described in detail in the MAP Guide, includes a MAP Summary Report and a MAP 
Detailed Report that are required to be submitted to the OCFO through ePMO. Below are brief 
descriptions of the MAP Summary and MAP Detailed Reports, based on the ePMO MAP Reports Quick 
Guide contained in the MAP Guide: 

• The MAP Summary Report contains sections to describe the issue (e.g. internal control deficiency 
conditions), results of the root cause analysis performed, relevant financial statement assertions 
affected by the issue, key strategies and performance measures, resources required, an analysis of 
the risks and impediments as seen by management, verification and validation methods, and the 
critical milestones to be achieved. 

• The MAP Detailed Report provides additional data on the milestones, not only on those identified 
as critical but also those sub-milestones under a critical milestone. For each milestone (critical or 
sub), the following data is reflected: due date, percentage of completion, status (e.g., Not Started, 
Work in Progress and Completed), and the responsible and assigned parties. 

The Department's Annual Financial Report (DHS AFR) was published on November 17, 2008 and 
consists of the Secretary's Message, Management's Discussion and Analysis, Financial Statements and 
Notes, an Independent Auditors' Report, Major Management Challenges, and other required information. 
The AFR was prepared pursuant to OMB Circular A- 13 6, Financial Reporting Requirements. 
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